Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-53277: Linux Kernel: KVM arm64 Page Table Walks Unlocked
CVE-2026-53277
CVE-2026-53277
Summary
A bug in the Linux kernel's KVM (Kernel Virtual Machine) for arm64 architecture allowed unauthorized changes to page tables. This has been fixed by ensuring that the kernel's lock is taken before accessing page tables. This fix ensures the integrity of page tables and prevents potential security risks.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux_kernel |
>= 6.12, < 6.18.36 >= 6.19, < 7.0.13 7.1 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux |
< 97706097f9b851cfe55c3b00b083dfc2bcf542bc 6.12 |
Original title
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
walk_s1() and kvm_walk_nested_s2() expe...
Original description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
walk_s1() and kvm_walk_nested_s2() expect to be called while holding
kvm->srcu to guard against memslot changes. While this is generally
the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the
respective walkers without taking kvm->srcu.
Fix by acquiring kvm->srcu prior to the table walk in both instances.
KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
walk_s1() and kvm_walk_nested_s2() expect to be called while holding
kvm->srcu to guard against memslot changes. While this is generally
the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the
respective walkers without taking kvm->srcu.
Fix by acquiring kvm->srcu prior to the table walk in both instances.
Vulnerability type
CWE-820
CWE-662
- https://git.kernel.org/stable/c/ec42b4ed1b072ea2d03f086061aa67bad6d8de39
- https://git.kernel.org/stable/c/f2ca45b50d4216c9cc7ffabf50d9ad1932209251
- https://access.redhat.com/security/cve/CVE-2026-53277
- https://bugzilla.redhat.com/show_bug.cgi?id=2492725
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53277.json
- https://git.kernel.org/stable/c/97706097f9b851cfe55c3b00b083dfc2bcf542bc
Published: 25 Jun 2026 · Updated: 15 Jul 2026 · First seen: 25 Jun 2026